Data Source: Linux Auditd Service Stop

Date: 2025-02-20

ID: 0643483c-bc62-455c-8d6e-1630e5f0e00d

Author: Teoderick Contreras, Splunk

Description

Logs events related to the stoppage of a service on a Linux system, including details about the service name, the process initiating the stop, and associated timestamps.

Details

Property Value
Source auditd
Sourcetype auditd
Separator type

Supported Apps

Event Fields

+ Fields 
  <span class="pill kill-chain">msg</span>
  
  <span class="pill kill-chain">type</span>
  
  <span class="pill kill-chain">pid</span>
  
  <span class="pill kill-chain">uid</span>
  
  <span class="pill kill-chain">auid</span>
  
  <span class="pill kill-chain">ses</span>
  
  <span class="pill kill-chain">subj</span>
  
  <span class="pill kill-chain">msg</span>
  
  <span class="pill kill-chain">comm</span>
  
  <span class="pill kill-chain">exe</span>
  
  <span class="pill kill-chain">hostname</span>
  
  <span class="pill kill-chain">addr</span>
  
  <span class="pill kill-chain">terminal</span>
  
  <span class="pill kill-chain">res</span>
  
  <span class="pill kill-chain">UID</span>
  
  <span class="pill kill-chain">AUID</span>
  
</div>

Example Log

1type=SERVICE_STOP msg=audit(1722957155.494:4802): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=atd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"

Source: GitHub | Version: 2